syzbot has found a reproducer for the following issue on:
HEAD commit: 9d6bde853685 Linux 5.15.112
git tree: linux-5.15.y
console output:
https://syzkaller.appspot.com/x/log.txt?x=16519f45280000
kernel config:
https://syzkaller.appspot.com/x/.config?x=508f7a387ef8f82b
userspace arch: arm64
syz repro:
https://syzkaller.appspot.com/x/repro.syz?x=13bf1cc5280000
C reproducer:
https://syzkaller.appspot.com/x/repro.c?x=143db7d6280000
Downloadable assets:
disk image:
https://storage.googleapis.com/syzbot-assets/a8ab2bd416bb/disk-9d6bde85.raw.xz
vmlinux:
https://storage.googleapis.com/syzbot-assets/c358e3d58bb2/vmlinux-9d6bde85.xz
kernel image:
https://storage.googleapis.com/syzbot-assets/c82319bbaeb8/Image-9d6bde85.gz.xz
mounted in repro:
https://storage.googleapis.com/syzbot-assets/1bf4f7ef173b/mount_0.gz
loop0: rw=0, want=13466418, limit=128
Buffer I/O error on dev loop0, logical block 13466417, async page read
attempt to access beyond end of device
loop0: rw=0, want=8073606, limit=128
Buffer I/O error on dev loop0, logical block 8073605, async page read
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Not tainted 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
__getblk_gfp+0x60/0x700 fs/buffer.c:1334
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
attempt to access beyond end of device
loop0: rw=0, want=3245519, limit=128
Buffer I/O error on dev loop0, logical block 3245518, async page read
attempt to access beyond end of device
loop0: rw=0, want=8769404, limit=128
Buffer I/O error on dev loop0, logical block 8769403, async page read
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
__getblk_gfp+0x60/0x700 fs/buffer.c:1334
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
__getblk_gfp+0x60/0x700 fs/buffer.c:1334
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
__getblk_gfp+0x60/0x700 fs/buffer.c:1334
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
__getblk_gfp+0x60/0x700 fs/buffer.c:1334
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at include/linux/pagemap.h:623
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
lock_page include/linux/pagemap.h:623 [inline]
pagecache_get_page+0x4bc/0xd94 mm/filemap.c:1910
find_or_create_page include/linux/pagemap.h:420 [inline]
grow_dev_page fs/buffer.c:949 [inline]
grow_buffers fs/buffer.c:1014 [inline]
__getblk_slow fs/buffer.c:1041 [inline]
__getblk_gfp+0x1f8/0x700 fs/buffer.c:1336
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at include/linux/pagemap.h:623
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
lock_page include/linux/pagemap.h:623 [inline]
pagecache_get_page+0x4bc/0xd94 mm/filemap.c:1910
find_or_create_page include/linux/pagemap.h:420 [inline]
grow_dev_page fs/buffer.c:949 [inline]
grow_buffers fs/buffer.c:1014 [inline]
__getblk_slow fs/buffer.c:1041 [inline]
__getblk_gfp+0x1f8/0x700 fs/buffer.c:1336
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at include/linux/pagemap.h:623
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
lock_page include/linux/pagemap.h:623 [inline]
pagecache_get_page+0x4bc/0xd94 mm/filemap.c:1910
find_or_create_page include/linux/pagemap.h:420 [inline]
grow_dev_page fs/buffer.c:949 [inline]
grow_buffers fs/buffer.c:1014 [inline]
__getblk_slow fs/buffer.c:1041 [inline]
__getblk_gfp+0x1f8/0x700 fs/buffer.c:1336
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
__getblk_gfp+0x60/0x700 fs/buffer.c:1334
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at include/linux/pagemap.h:623
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217
Preemption disabled at:
[<ffff800009305e7c>] get_block+0x148/0x1388 fs/sysv/itree.c:217
CPU: 0 PID: 3963 Comm: syz-executor343 Tainted: G W 5.15.112-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
___might_sleep+0x380/0x4dc kernel/sched/core.c:9625
__might_sleep+0x98/0xf0 kernel/sched/core.c:9579
lock_page include/linux/pagemap.h:623 [inline]
pagecache_get_page+0x4bc/0xd94 mm/filemap.c:1910
find_or_create_page include/linux/pagemap.h:420 [inline]
grow_dev_page fs/buffer.c:949 [inline]
grow_buffers fs/buffer.c:1014 [inline]
__getblk_slow fs/buffer.c:1041 [inline]
__getblk_gfp+0x1f8/0x700 fs/buffer.c:1336
__bread_gfp+0x40/0x33c fs/buffer.c:1381
sb_bread include/linux/buffer_head.h:337 [inline]
get_branch+0x234/0x55c fs/sysv/itree.c:104
get_block+0x164/0x1388 fs/sysv/itree.c:218
block_read_full_page+0x2a0/0xc4c fs/buffer.c:2290
sysv_readpage+0x28/0x38 fs/sysv/itree.c:461
do_read_cache_page+0x60c/0x950
read_cache_page+0x68/0x84 mm/filemap.c:3565
read_mapping_page include/linux/pagemap.h:515 [inline]
dir_get_page fs/sysv/dir.c:58 [inline]
sysv_find_entry+0x178/0x43c fs/sysv/dir.c:146
sysv_inode_by_name+0xa0/0x1c0 fs/sysv/dir.c:360
sysv_lookup+0x74/0xe4 fs/sysv/namei.c:38
__lookup_slow+0x250/0x388 fs/namei.c:1659
lookup_slow+0x60/0x84 fs/namei.c:1676
walk_component+0x394/0x4cc fs/namei.c:1972
link_path_walk+0x5a0/0xc38
path_openat+0x1e8/0x26f0 fs/namei.c:3668
do_filp_open+0x1a8/0x3b4 fs/namei.c:3699
do_sys_openat2+0x128/0x3d8 fs/open.c:1211
do_sys_open fs/open.c:1227 [inline]
__do_sys_openat fs/open.c:1243 [inline]
__se_sys_openat fs/open.c:1238 [inline]
__arm64_sys_openat+0x1f0/0x240 fs/open.c:1238
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
BUG: sleeping function called from invalid context at fs/buffer.c:1334
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3963, name: syz-executor343
2 locks held by syz-executor343/3963:
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: inode_lock_shared include/linux/fs.h:797 [inline]
#0: ffff0000dc3e0188 (&type->i_mutex_dir_key#6){.+.+}-{3:3}, at: lookup_slow+0x50/0x84 fs/namei.c:1675
#1: ffff800014d0aad8 (pointers_lock){.+.+}-{2:2}, at: get_block+0x148/0x1388 fs/sysv/itree.c:217